CWEweakness
CWE-282 Improper Ownership Management
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
Common consequences
• Access Control: Gain Privileges or Assume Identity
Potential mitigations
• [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-1999-1125: Program runs setuid root but relies on a configuration file owned by a non-root user.
Related
Attack pattern · CAPEC (2)
Observed example · CVE (1)
- CVE-1999-1125 Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or… vulnerability
Child of · CWE (1)
- CWE-284 Improper Access Control weakness
Referenced by CAPEC · weakness (2)
Referenced by CVE · weakness (31)
- CVE-2026-108304 Tanium addressed a local privilege escalation vulnerability in End-User Notifications. vulnerability
- CVE-2026-86769 Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records… vulnerability
- CVE-2026-50130 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. vulnerability
- CVE-2026-40214 In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. vulnerability
- CVE-2026-3867 An improper ownership management vulnerability has been identified in Moxa’s Secure Router. vulnerability
- CVE-2026-23514 Kiteworks is a private data network (PDN). vulnerability
- CVE-2025-67642 Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing… vulnerability
- CVE-2025-57732 In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership vulnerability
- CVE-2025-1112 IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to… vulnerability
- CVE-2025-46416 The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user… vulnerability
- CVE-2025-3629 IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to… vulnerability
- CVE-2025-32945 The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. vulnerability
- CVE-2025-32946 This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. vulnerability
- CVE-2025-27254 CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. vulnerability
- CVE-2024-13246 Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue… vulnerability
- CVE-2024-13249 Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue… vulnerability
- CVE-2024-43176 IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to… vulnerability
- CVE-2024-47816 ImportDump is a mediawiki extension designed to automate user import requests. vulnerability
- CVE-2024-39755 A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. vulnerability
- CVE-2024-8949 A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. vulnerability
- CVE-2024-45103 A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient… vulnerability
- CVE-2024-45104 A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device… vulnerability
- CVE-2024-37999 A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). vulnerability
- CVE-2024-3383 A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables… vulnerability
- CVE-2023-7226 A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. vulnerability
- CVE-2023-0989 An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4… vulnerability
- CVE-2023-0386 A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the… vulnerability
- CVE-2022-29187 Git is a distributed revision control system. vulnerability
- CVE-2022-0026 A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an… vulnerability
- CVE-2020-10632 Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration… vulnerability
Referenced by CWE · child of (2)
Referenced by OWASP · mapped cwe (1)
- A01:2025 Broken Access Control Top 10 2025